ace-compliance 0.1.0__tar.gz

ace_compliance-0.1.0/PKG-INFO

@@ -0,0 +1,59 @@
+Metadata-Version: 2.4
+Name: ace-compliance
+Version: 0.1.0
+Summary: ACE+RHG CLI — scan infrastructure artifacts for compliance violations before they ship
+Author-email: Omkar <omkar@ace-rhg.dev>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/omkarP-bit/AI-Compliance-Engine-RHG
+Project-URL: Repository, https://github.com/omkarP-bit/AI-Compliance-Engine-RHG
+Project-URL: Documentation, https://github.com/omkarP-bit/AI-Compliance-Engine-RHG#readme
+Project-URL: Changelog, https://github.com/omkarP-bit/AI-Compliance-Engine-RHG/releases
+Keywords: compliance,security,kubernetes,terraform,devsecops,opa,policy-as-code
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+Requires-Dist: click>=8.0
+Requires-Dist: httpx>=0.27
+Requires-Dist: pyyaml>=6.0
+
+# ACE+RHG — AI Compliance Engine + Release Hardening Gate
+
+Production-grade DevSecOps platform that enforces security compliance automatically inside CI/CD pipelines — before any artifact ever touches production.
+
+## ace-compliance CLI
+
+```bash
+pip install ace-compliance
+
+# Scan a file
+ace scan deploy.yaml
+
+# Scan a directory, fail pipeline on HIGH+
+ace scan ./k8s/ ./terraform/ --env production --fail-on HIGH
+
+# JSON output for CI integration
+ace scan ./artifacts/ --output json
+```
+
+The CLI sends artifacts to the ACE service, evaluates them against CIS/NIST/ISO policy bundles via OPA, and returns structured findings with risk scores.
+
+## Quick Start
+
+```bash
+# Full local stack
+docker compose up -d
+ace scan samples/vulnerable-deploy.yaml --env staging
+```
+
+## Documentation
+
+- `CLAUDE.md` — full system concept, architecture, API contracts
+- `DEVELOPMENT.md` — build guide, phase map, test matrix, Lambda deployment

ace_compliance-0.1.0/README.md

@@ -0,0 +1,33 @@
+# ACE+RHG — AI Compliance Engine + Release Hardening Gate
+
+Production-grade DevSecOps platform that enforces security compliance automatically inside CI/CD pipelines — before any artifact ever touches production.
+
+## ace-compliance CLI
+
+```bash
+pip install ace-compliance
+
+# Scan a file
+ace scan deploy.yaml
+
+# Scan a directory, fail pipeline on HIGH+
+ace scan ./k8s/ ./terraform/ --env production --fail-on HIGH
+
+# JSON output for CI integration
+ace scan ./artifacts/ --output json
+```
+
+The CLI sends artifacts to the ACE service, evaluates them against CIS/NIST/ISO policy bundles via OPA, and returns structured findings with risk scores.
+
+## Quick Start
+
+```bash
+# Full local stack
+docker compose up -d
+ace scan samples/vulnerable-deploy.yaml --env staging
+```
+
+## Documentation
+
+- `CLAUDE.md` — full system concept, architecture, API contracts
+- `DEVELOPMENT.md` — build guide, phase map, test matrix, Lambda deployment

ace_compliance-0.1.0/ace_compliance/__main__.py

@@ -0,0 +1,4 @@
+from ace_compliance.cli import cli
+
+if __name__ == "__main__":
+    cli()

ace_compliance-0.1.0/ace_compliance/cli.py

@@ -0,0 +1,102 @@
+import asyncio
+import base64
+import json
+import os
+from pathlib import Path
+
+import click
+import httpx
+
+ACE_URL = os.environ.get("ACE_URL", "http://localhost:8000")
+SEVERITY_ORDER = {"CRITICAL": 4, "HIGH": 3, "MEDIUM": 2, "LOW": 1, "INFO": 0}
+
+
+@click.group()
+def cli():
+    """ace-compliance — scan infrastructure before it ships."""
+
+
+@cli.command()
+@click.argument("paths", nargs=-1, type=click.Path(exists=True))
+@click.option("--env", default="production", help="Target environment")
+@click.option("--output", type=click.Choice(["text", "json"]), default="text")
+@click.option("--fail-on", type=click.Choice(["CRITICAL", "HIGH", "MEDIUM", "LOW"]), default="HIGH")
+@click.option("--ace-url", envvar="ACE_URL", default=ACE_URL, help="ACE service URL")
+def scan(paths, env, output, fail_on, ace_url):
+    """Scan one or more artifact files for compliance violations."""
+    asyncio.run(_scan(list(paths), env, output, fail_on, ace_url))
+
+
+async def _scan(paths: list[str], env: str, output: str, fail_on: str, ace_url: str):
+    artifacts = []
+
+    for path_str in paths:
+        p = Path(path_str)
+        if p.is_dir():
+            for f in p.rglob("*.yaml"):
+                artifacts.append(_make_artifact(f))
+            for f in p.rglob("*.yml"):
+                artifacts.append(_make_artifact(f))
+            for f in p.rglob("*.tf"):
+                artifacts.append(_make_artifact(f))
+        else:
+            artifacts.append(_make_artifact(p))
+
+    if not artifacts:
+        click.echo("No supported artifacts found.", err=True)
+        raise SystemExit(1)
+
+    async with httpx.AsyncClient() as client:
+        resp = await client.post(
+            f"{ace_url}/ace/scan",
+            json={
+                "pipeline_id": "cli-scan",
+                "environment": env,
+                "artifacts": artifacts,
+            },
+            timeout=30.0,
+        )
+        resp.raise_for_status()
+        result = resp.json()
+
+    if output == "json":
+        click.echo(json.dumps(result, indent=2))
+    else:
+        _print_text_report(result)
+
+    overall = result.get("overall_severity", "INFO")
+    if SEVERITY_ORDER.get(overall, 0) >= SEVERITY_ORDER.get(fail_on, 0):
+        raise SystemExit(1)
+
+
+def _make_artifact(path: Path) -> dict:
+    ext = path.suffix
+    artifact_type = "kubernetes" if ext in (".yaml", ".yml") else "terraform"
+    return {
+        "type": artifact_type,
+        "name": path.name,
+        "content": base64.b64encode(path.read_bytes()).decode(),
+    }
+
+
+def _print_text_report(result: dict):
+    findings = result.get("findings", [])
+    click.echo("")
+    click.echo("=" * 60)
+    click.echo(f"  Risk Score:  {result.get('risk_score', '?')}/10")
+    click.echo(f"  Severity:    {result.get('overall_severity', '?')}")
+    click.echo(f"  Findings:    {len(findings)}")
+    click.echo("=" * 60)
+    for f in findings:
+        sev = f.get("severity", "?")
+        rule_id = f.get("rule_id", "?")
+        msg = f.get("message", "")
+        artifact = f.get("artifact", "")
+        color = {"CRITICAL": "red", "HIGH": "yellow", "MEDIUM": "blue", "LOW": "white"}.get(sev, "white")
+        click.echo(f"  [{click.style(sev, fg=color)}] {rule_id}  {artifact}")
+        click.echo(f"       {msg}")
+    click.echo("")
+
+
+if __name__ == "__main__":
+    cli()

ace_compliance-0.1.0/ace_compliance.egg-info/PKG-INFO

@@ -0,0 +1,59 @@
+Metadata-Version: 2.4
+Name: ace-compliance
+Version: 0.1.0
+Summary: ACE+RHG CLI — scan infrastructure artifacts for compliance violations before they ship
+Author-email: Omkar <omkar@ace-rhg.dev>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/omkarP-bit/AI-Compliance-Engine-RHG
+Project-URL: Repository, https://github.com/omkarP-bit/AI-Compliance-Engine-RHG
+Project-URL: Documentation, https://github.com/omkarP-bit/AI-Compliance-Engine-RHG#readme
+Project-URL: Changelog, https://github.com/omkarP-bit/AI-Compliance-Engine-RHG/releases
+Keywords: compliance,security,kubernetes,terraform,devsecops,opa,policy-as-code
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+Requires-Dist: click>=8.0
+Requires-Dist: httpx>=0.27
+Requires-Dist: pyyaml>=6.0
+
+# ACE+RHG — AI Compliance Engine + Release Hardening Gate
+
+Production-grade DevSecOps platform that enforces security compliance automatically inside CI/CD pipelines — before any artifact ever touches production.
+
+## ace-compliance CLI
+
+```bash
+pip install ace-compliance
+
+# Scan a file
+ace scan deploy.yaml
+
+# Scan a directory, fail pipeline on HIGH+
+ace scan ./k8s/ ./terraform/ --env production --fail-on HIGH
+
+# JSON output for CI integration
+ace scan ./artifacts/ --output json
+```
+
+The CLI sends artifacts to the ACE service, evaluates them against CIS/NIST/ISO policy bundles via OPA, and returns structured findings with risk scores.
+
+## Quick Start
+
+```bash
+# Full local stack
+docker compose up -d
+ace scan samples/vulnerable-deploy.yaml --env staging
+```
+
+## Documentation
+
+- `CLAUDE.md` — full system concept, architecture, API contracts
+- `DEVELOPMENT.md` — build guide, phase map, test matrix, Lambda deployment

ace_compliance-0.1.0/ace_compliance.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+README.md
+pyproject.toml
+ace_compliance/__init__.py
+ace_compliance/__main__.py
+ace_compliance/cli.py
+ace_compliance.egg-info/PKG-INFO
+ace_compliance.egg-info/SOURCES.txt
+ace_compliance.egg-info/dependency_links.txt
+ace_compliance.egg-info/entry_points.txt
+ace_compliance.egg-info/requires.txt
+ace_compliance.egg-info/top_level.txt
+tests/test_cli.py

ace_compliance-0.1.0/ace_compliance.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

ace_compliance-0.1.0/ace_compliance.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+ace = ace_compliance.cli:cli

ace_compliance-0.1.0/ace_compliance.egg-info/requires.txt

@@ -0,0 +1,3 @@
+click>=8.0
+httpx>=0.27
+pyyaml>=6.0

ace_compliance-0.1.0/ace_compliance.egg-info/top_level.txt

@@ -0,0 +1 @@
+ace_compliance

ace_compliance-0.1.0/pyproject.toml

@@ -0,0 +1,46 @@
+[build-system]
+requires = ["setuptools>=68.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "ace-compliance"
+version = "0.1.0"
+description = "ACE+RHG CLI — scan infrastructure artifacts for compliance violations before they ship"
+readme = "README.md"
+license = "MIT"
+requires-python = ">=3.12"
+authors = [
+    { name = "Omkar", email = "omkar@ace-rhg.dev" },
+]
+keywords = ["compliance", "security", "kubernetes", "terraform", "devsecops", "opa", "policy-as-code"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Intended Audience :: System Administrators",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security",
+    "Topic :: Software Development :: Quality Assurance",
+    "Topic :: System :: Systems Administration :: Authentication/Directory",
+]
+dependencies = [
+    "click>=8.0",
+    "httpx>=0.27",
+    "pyyaml>=6.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/omkarP-bit/AI-Compliance-Engine-RHG"
+Repository = "https://github.com/omkarP-bit/AI-Compliance-Engine-RHG"
+Documentation = "https://github.com/omkarP-bit/AI-Compliance-Engine-RHG#readme"
+Changelog = "https://github.com/omkarP-bit/AI-Compliance-Engine-RHG/releases"
+
+[project.scripts]
+ace = "ace_compliance.cli:cli"
+
+[tool.setuptools.packages.find]
+include = ["ace_compliance*"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"

ace_compliance-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

ace_compliance-0.1.0/tests/test_cli.py

@@ -0,0 +1,71 @@
+from unittest.mock import AsyncMock, MagicMock, patch
+
+from ace_compliance.cli import cli
+from click.testing import CliRunner
+
+MOCK_SCAN_RESPONSE = {
+    "scan_id": "abc-123",
+    "pipeline_id": "cli-scan",
+    "risk_score": 7.5,
+    "overall_severity": "HIGH",
+    "findings": [
+        {"rule_id": "CIS-K8S-5.2.1", "severity": "HIGH",
+         "message": "Privileged container", "artifact": "deploy.yaml"}
+    ]
+}
+
+
+class TestCLI:
+    def setup_method(self):
+        self.runner = CliRunner()
+
+    def test_scan_exits_nonzero_on_high_findings(self, tmp_path):
+        f = tmp_path / "deploy.yaml"
+        f.write_text("apiVersion: v1\nkind: Pod")
+        with patch("ace_compliance.cli.httpx.AsyncClient") as mock_client:
+            mock_client.return_value.__aenter__.return_value.post = AsyncMock(
+                return_value=MagicMock(
+                    status_code=200,
+                    json=lambda: MOCK_SCAN_RESPONSE,
+                    raise_for_status=lambda: None,
+                )
+            )
+            result = self.runner.invoke(cli, ["scan", str(f), "--fail-on", "HIGH"])
+            assert result.exit_code == 1
+
+    def test_scan_exits_zero_on_clean_artifact(self, tmp_path):
+        f = tmp_path / "deploy.yaml"
+        f.write_text("apiVersion: v1\nkind: Pod")
+        clean_response = {**MOCK_SCAN_RESPONSE, "overall_severity": "LOW", "findings": []}
+        with patch("ace_compliance.cli.httpx.AsyncClient") as mock_client:
+            mock_client.return_value.__aenter__.return_value.post = AsyncMock(
+                return_value=MagicMock(
+                    status_code=200,
+                    json=lambda: clean_response,
+                    raise_for_status=lambda: None,
+                )
+            )
+            result = self.runner.invoke(cli, ["scan", str(f), "--fail-on", "HIGH"])
+            assert result.exit_code == 0
+
+    def test_json_output_flag(self, tmp_path):
+        f = tmp_path / "deploy.yaml"
+        f.write_text("apiVersion: v1\nkind: Pod")
+        with patch("ace_compliance.cli.httpx.AsyncClient") as mock_client:
+            mock_client.return_value.__aenter__.return_value.post = AsyncMock(
+                return_value=MagicMock(
+                    status_code=200,
+                    json=lambda: MOCK_SCAN_RESPONSE,
+                    raise_for_status=lambda: None,
+                )
+            )
+            result = self.runner.invoke(cli, ["scan", str(f), "--output", "json"])
+            assert result.exit_code == 1
+            assert '"scan_id":' in result.output
+
+    def test_scan_helps_with_no_artifacts(self, tmp_path):
+        empty_dir = tmp_path / "empty"
+        empty_dir.mkdir()
+        result = self.runner.invoke(cli, ["scan", str(empty_dir)])
+        assert result.exit_code == 1
+        assert "No supported artifacts found" in result.output